Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing Ftp Server

CVE-2025-47812

githubexploit · 2026-02-15

Description

Exploit for improper neutralization of null byte in Wing FTP Server.

Entry point

Parameterusername · request body

Pathloginok.html

NULL-byte truncation allows bypassing authentication prefix and injecting Lua code into execution context (RCE).

Affected Wftpserver Wing Ftp Server versions

Wftpserver Wing Ftp Server< 7.4.4

All known vulnerabilities by product

Wing Ftp Server

CVSS 10.0 for CVE-2025-47812

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

94%confidence this exploit runs

Based on 1 file(s) in the source

EPSS Score

92.8%higher than 99.8% of all CVEs

Updated 2026-08-31

Exploit Details

Modified:2026-02-15 01:06

Last Seen:2026-02-15 01:13

Reporter:matesz44

Written in:Shell

Last commit:2026-02-15

Other exploits for CVE-2025-47812

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

Exploit_CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

WingFTP-CVE-2025-47812-illdeed

2026-09-06 KitPloitKITPLOIT

Blackash-CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

CVE-2025-47812

2026-09-06 KitPloitKITPLOIT

Exploit Code

README2 lines

## https://sploitus.com/exploit?id=944A9F6C-4FED-5C05-93B1-F5F1AE0FBA23
CVE-2025-47812: Wing FTP Server 7.4.3 UnauthN RCE in sh

Exploit Code

Share

Share on social media: